Researchers have identified an Android backdoor named ‘Xamalicious’, which has infected approximately 338,300 devices via malicious apps on Google Play.
Computer security software company McAfee discovered 14 infected apps on Google Play, with three having 100,000 installs each, reports Bleeping Computer.
Although the apps have been removed from Google Play, users who installed them since mid-2020 may still have active Xamalicious infections on their phones, which require manual cleanup and scanning.
The most popular of the Xamalicious apps include — Essential Horoscope for Android (100,000 installs), 3D Skin Editor for PE Minecraft (100,000 installs), Logo Maker Pro (100,000 installs), Auto Click Repeater (10,000 installs), Count Easy Calorie Calculator (10,000 installs), Dots: One Line Connector (10,000 installs), and Sound Volume Extender (5,000 installs).
In addition, a distinct group of 12 malicious apps carrying the Xamalicious threat is disseminated on unapproved third-party app stores, infecting users via downloading APK (Android package) files, the report mentioned.
The majority of infections were installed on devices in the United States, Germany, Spain, the UK, Australia, Brazil, Mexico, and Argentina, according to McAfee telemetry data.
Xamalicious is a.NET-based Android backdoor that is placed (as ‘Core.dll’ and ‘GoogleService.dll’) within apps built with the open-source Xamarin framework, making code analysis more difficult.
It asks for Accessibility Service access upon installation, allowing it to perform privileged operations such as navigation gestures, hide on-screen objects, and grant itself further permissions.
Following installation, it contacts with the C2 (command and control) server to retrieve the second-stage DLL payload (‘cache.bin’) if certain geographical, network, device configuration, and root status requirements are met.
